1. Introduction
XamPro and 1-2.io are owned and operated by EduSoft LTD (Company No. 15827191, registered in England and Wales). Our services support examination proctoring, school administration and communications for UK schools, colleges and education trusts.
This notice covers personal data handled through XamPro and our 1-2.io URL Links service, including short-link creation and redirects, hosted PDFs, QR codes, click analytics and the developer API. It applies to school staff and to students, parents, carers and other people who open these links or whose information appears in school-provided content.
For personal data processed on an educational institution's behalf, the institution or relevant local education authority is the Data Controller and EduSoft LTD is the Data Processor. We process that data under the institution's documented instructions and Data Processing Agreement (DPA). The institution decides what information to share and how to use link analytics, and should explain this in its own privacy information. Signing a DPA is not consent from the individuals whose data is processed.
EduSoft LTD acts as a controller where we determine the purposes of processing, such as handling business enquiries, administering our customer relationships and protecting our services against misuse.
2. Legal Basis for Processing
Educational institutions are responsible for identifying and documenting the lawful basis for the processing they instruct us to carry out, including school communications and link analytics. Depending on the purpose and the institution, this may include:
- Public Task: Where processing is necessary for an institution's educational functions supported by law.
- Legitimate Interests: Where available to the controller and necessary for a stated purpose, such as assessing the reach of school communications, after considering individuals' interests and rights.
- Contract: Where processing is necessary for a contract with the individual concerned. A contract between a school and EduSoft LTD does not, by itself, provide this basis for processing student or parent data.
For our own business contact and service administration data, EduSoft LTD relies on legitimate interests in responding to enquiries, supporting customers and operating and securing our services. We also process information where necessary to comply with a legal obligation. Opening a short link does not constitute consent to unrelated marketing.
3. Categories of Data Collected
The following categories of data are collected and processed by XamPro:
3.1 School and Staff Data
| Data Category | Purpose & Legal Justification |
|---|---|
| School Name | Required for identification and administrative purposes. |
| DfE Number | Ensures correct linkage with national education databases. |
| Primary Contact Information | Used for official communication and support requests. |
| Local Authority | Used for regulatory reporting and compliance. |
| Staff Title | Used to define the role of staff members within the institution. |
| Legal Forename & Surname | Required for staff identification and account creation. |
| Email Address | Used for authentication, account recovery, and communication. |
| Job Designation | Required to assign appropriate user roles and permissions. |
3.2 Student Data
| Data Category | Purpose & Legal Justification |
|---|---|
| Unique Pupil Number (UPN) | Required for uniquely identifying students and ensuring accurate record-keeping. |
| Admission Number (AdNo) | Used internally by schools to maintain admission records. |
| Legal Forename & Surname | Essential for student identity verification and linking to examination results. |
| Date of Birth | Ensures eligibility for age-restricted examinations and prevents duplicate records. |
| Gender | Used for statistical reporting and compliance with examination board requirements. |
| Admission & Leavers Date | Ensures accurate records for active and former students. |
3.3 Short Links, Documents and API Data
When an institution uses 1-2.io through XamPro or the developer API, we process the information needed to create and manage its links:
| Data Category | Purpose |
|---|---|
| Destination URL, short code and tracking identifier | Connect a short link or QR code to its destination and associate click activity with that link. Destination URLs may themselves contain personal information. |
| Link title, notes, creation details and settings | Allow the institution to organise its links and manage their status. XamPro records the institution, creating staff account and any expiry setting. |
| Uploaded PDF, filename and access details | Host and deliver documents selected by the institution. This includes any personal information within the document and, where enabled in XamPro, the document password and access settings. |
| API account, key, usage quota and request IP address | Authenticate API requests, associate links with the customer account and manage usage limits. The request IP may belong to the institution's system or the XamPro server making the request. |
3.4 Click Analytics
When someone follows an active 1-2.io short link, including by opening a QR code, we record the link accessed, click date and time, IP address, browser-supplied user-agent information, device type, browser, operating system and referring page or source where the browser provides it. We use these records to provide the institution with click totals, activity over time, device and browser breakdowns, referrer information and recent click activity.
To estimate unique visits, the service generates a daily identifier from the IP address and user-agent information. This identifier is used to recognise repeat visits to the same link on the same day. Unique-visitor figures are estimates, not a verified count of individual people. IP addresses and other click details are still stored, so these records are not treated as anonymous. A click alone does not confirm a visitor's name or that they read a document.
These analytics help institutions understand whether their communications are reaching their audience. We do not sell this data or use it for advertising profiles.
3.5 Cookies and Tracking
1-2.io short-link click analytics are recorded on our servers and do not rely on analytics cookies or third-party advertising trackers. When XamPro serves a hosted PDF, a session cookie supports document access, including remembering successful password access during that session.
The XamPro public website uses Google Analytics to measure website visits. This is separate from the click analytics for 1-2.io redirects. A destination website may use its own cookies and analytics, as explained in that website's privacy notice.
4. Data Sharing and Security
EduSoft LTD does not sell personal data. Data is made available where needed to provide our services or meet legal requirements:
- With the Institution: Staff with the relevant XamPro permissions can manage their institution's links and view analytics. API customers can access their link details using their API credentials.
- With Service Providers: Hosting, network security and website analytics providers process information needed for their services. 1-2.io is operated by EduSoft LTD; creating a 1-2.io link does not send it to an unrelated commercial URL-shortening provider.
- With SMS Service Providers: For schools using the SMS module, only the message content and recipient contact details (mobile/landline number) are shared with UK ICO-compliant SMS gateway providers.
- Legal Compliance: We may disclose data where legally required, such as to law enforcement agencies or regulatory bodies.
Linked websites: Following a short link sends your browser to the destination selected by the institution. That destination receives the information normally supplied by your browser, such as your IP address, and handles it under its own privacy notice. EduSoft LTD does not control how an independently operated destination website uses personal data.
Sharing documents: A short link or QR code is not, by itself, proof that a visitor is authorised to see a document. Institutions should share only appropriate content and use suitable access controls for personal or confidential information. XamPro offers password protection for PDFs marked as containing personal information; direct PDF uploads through the 1-2.io API do not have that XamPro password gate. Anyone with an unprotected document link may be able to open or forward it.
Data security measures include:
- Account passwords stored using salted password hashes.
- Data hosted on UK-based Amazon AWS servers with full Data Protection Act 2018 compliance.
- The 1-2.io link service and hosted documents use UK-hosted infrastructure operated for EduSoft LTD.
- Data transmission secured via Cloudflare web application filtering and load balancing.
- HTTPS encryption in transit when accessing XamPro and 1-2.io.
- Mandatory Two-Factor Authentication (2FA) for all system users (excluding students using access codes).
- Strict password policy: minimum 8 characters, at least one special character, no password reuse.
5. Data Retention & Deletion
For school subscription data held in XamPro:
- Data is stored for the duration of the school's active subscription.
- Upon subscription termination, data is retained for 31 days before permanent deletion.
- Schools may request data deletion at any time via a formal support request.
- Schools may request a copy of their data with written consent from the headteacher.
For 1-2.io, retention of short-link records, hosted files, click records and API account information is determined by the need to operate the institution's links and provide its requested analytics, its documented instructions, the active service relationship and any continuing support, security or legal requirements. Contact us for the retention arrangements applicable to your institution or API account.
Link status and data deletion are different: pausing a link or reaching a configured expiry does not erase its stored records or previous click activity. Deleting a link in XamPro removes its XamPro record and any PDF stored for it, and deactivates the short link; it does not automatically erase the separate 1-2.io link record or click history. Institutions can request removal of those records and files uploaded directly through the API via support. The dashboard's 30-day chart is a reporting window, not a promise that all click data is deleted after 30 days.
6. Changes to This Policy
We may update this notice to reflect changes to XamPro, 1-2.io, our data practices or legal requirements. The date and revision number above identify the current version. Significant changes will be communicated to schools via email to registered primary contacts and through system announcements within XamPro.
7. ICO Registration
EduSoft LTD is registered with the Information Commissioner's Office (ICO) under registration number ZB799468. This registration applies to EduSoft LTD as the operator of XamPro and 1-2.io.
8. Your Rights and Contact Information
Depending on the processing and lawful basis, you may have rights to access, correct or erase your personal data, restrict its use and receive a portable copy. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.
Right to object: you can object to processing based on public task or legitimate interests on grounds relating to your situation. The controller will consider the request under the applicable data protection rules.
For data processed on your school or institution's behalf, including its documents and link analytics, contact the institution or its data protection officer first. We assist institutions with requests under our DPA. You can also contact us about XamPro or 1-2.io privacy matters; providing the relevant short link can help us locate the institution and records concerned. An individual's data-rights request does not require headteacher consent.
For privacy-related enquiries, please contact us:
Email: [email protected]
If your concern is unresolved, you may escalate to the ICO: www.ico.org.uk
9. Revision History
- Revision 1.0.3 — December 2025: Added 1-2.io short links, hosted PDFs, QR codes, click analytics, cookies and developer API processing; clarified controller roles, sharing, retention, deletion and individual rights.
- Revision 1.0.2 — 15 February 2025: Corrected broken hyperlink; Clause 4 revised to include SMS provider data sharing information.